CVE-2026-46514 Details
Description
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.
A vulnerability in Frogman PBX control software prior to version 1.6.2 allows for the exposure of plaintext passwords and device secrets through the audit log. The issue arises because certain tools return sensitive information in their responses, which is then logged without redaction. Users with read-only permissions can access this audit log and retrieve the exposed credentials.
Users are advised to upgrade to Frogman version 1.6.2, which addresses the vulnerability by redacting sensitive information before it is logged. The update also requires that the 'fm_audit_search' function be called with admin-level permissions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mwtcmi/frogman/commit/02203edb613774f265ad8a21d99c4f6cf7de0d4d | [email protected] | Source CodeVendor |
| https://github.com/mwtcmi/frogman/releases/tag/v1.6.1 | [email protected] | AdvisoryBundleRemedyVendor |
| https://github.com/mwtcmi/frogman/releases/tag/v1.6.2 | [email protected] | Release NotesVendor |
| https://github.com/mwtcmi/frogman/security/advisories/GHSA-3p65-2prr-cfvf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frogman | <= 1.6.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | New CVE Received | [email protected] |
| Jul 16, 2026 | CVE Modified | CISA-ADP |